Can Facebook phishing scams steal your email and password by just having you click a link?

As the question says, can devious people steal your email and password; log in info by just getting you to click a link?

I just changed my Facebook password cuase someone got into my account and started posting bogus stuff on my page and sending it to a bunch of my friends; something like "I just quit my job after 4 years.....now I'm working at home making $35,000..... And it was followed by a link.

That's what was posted on my page; I think I messed up when I got similar but different message from a friends account that was saying something like "I've been trying to get a hold of you for a long time....there's nasty pictures of you on this site. That also had a link in it and I clicked the link which look like it was going to a page but quickly covered up by a page that looked like Facebook and asked you to log in.

When the Facebook log in appeared like that and I knew I clicked on the link from Facebook where I was already logged in I thought it was suspicious and didn't enter my log info; just went to a another page and eventually back to the actual Facebook page. Well yesterday and today I soon found out my page was sending multiple messages to people on my friends list.

I changed my password now, removed the spam and have my account back; but I was wondering can email and passwords be stolen just by clicking the phishing links? Cause when I ended up on that fake Facebook page I didnt enter my email or password.